Overview
The Iqra AI API uses API key authentication to secure all endpoints. You must include your API key in theAuthorization header of every request.
Authentication method
All API requests must include an API key in theAuthorization header using the Token scheme:
Creating an API key
You can create API keys through the Iqra AI dashboard:- Navigate to the API Keys section in your account settings
- Click “Create New API Key”
- Configure the following settings:
A descriptive name for the API key to help you identify its purpose
Optional list of business IDs to restrict this API key’s access. If not specified, the key can access all your businesses.
Whether this API key can be used for user management endpoints
Authentication validation
When you make an API request, the system validates:- API key validity: The key must exist and be active
- Business restrictions: If the key has business restrictions, it can only access those specific businesses
- User permissions: The user associated with the API key must not be disabled
- Business permissions: The target business must not be disabled and you must have appropriate access
Example request
Error responses
If authentication fails, you’ll receive a response withSuccess: false and an error code:
Will be
false for authentication errorsError code indicating the type of failure (e.g.,
INVALID_API_KEY, PERMISSION_DENIED)Human-readable error message describing what went wrong
Common authentication errors
| Code | Description |
|---|---|
INVALID_API_KEY | The API key is invalid or has been revoked |
PERMISSION_DENIED | The API key doesn’t have access to the requested resource |
USER_DISABLED | The user account associated with the API key is disabled |
BUSINESS_DISABLED | The business you’re trying to access is disabled |
Security best practices
- Store API keys securely using environment variables or a secrets manager
- Use different API keys for different environments (development, staging, production)
- Restrict API keys to specific businesses when possible
- Rotate API keys periodically
- Delete unused API keys immediately
- Monitor API key usage for suspicious activity
Rate limiting
API requests are subject to rate limiting to ensure fair usage. If you exceed the rate limit, you’ll receive a429 Too Many Requests response. Contact support if you need higher rate limits for your use case.